SYRADATABCBUZZ Technologies
Back to Home
DPDPA 2023 COMPLIANT PRIVACY NOTICE

Privacy Policy & Statutory Notice

Effective Date: August 29, 2026 · Version: 2.4 · Data Fiduciary: BCBUZZ Technologies Private Limited

Summary at a Glance (Plain Language Overview)

This summary gives you a quick, transparent overview of how SYRA DATA processes and safeguards your personal data in full compliance with the Digital Personal Data Protection Act (DPDPA), 2023.

What We Collect: Corporate account details, work emails, technical audit logs, and scan target metadata.
Why We Collect: To perform automated DPDPA compliance audits, manage subscriptions, and provide support.
Data Retention: Transient scan logs are retained for 90 days; active account data is retained for 2 years or until deletion request.
Your Rights: Instant access, correction, erasure, grievance redressal, and nomination under Section 6 & 11-14.

1. Data Fiduciary & Identity

BCBUZZ Technologies Private Limited ("we", "us", "our") operates the SYRA DATA compliance scanning platform and acts as the Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023.

Corporate Identity: CIN: U72900KA2024PTC189000 | GSTIN: 27AABCU9603R1ZM
Registered Office: Bengaluru, Karnataka, India | Contact: dpdp@bcbuzz.io

2. Itemised Purposes of Processing (Section 6)

Personal data is collected and processed solely for specified, explicit, and legitimate purposes:

  • Service Delivery & Compliance Scan: Running 7-module automated DPDPA statutory evaluations on submitted website endpoints.
  • Account Creation & Management: Authenticating users via secure one-time passwords (OTP) and role-based workspace permissions.
  • Billing & Invoicing: Generating tax receipts, managing subscription tiers, and applying scan promo codes.
  • Customer Support: Responding to technical queries, support tickets, and diagnostic requests.
  • Security & Fraud Prevention: Protecting platform integrity, enforcing rate limits, and maintaining tamper-evident audit logs.

3. Categories of Personal Data Collected

We restrict data collection to the minimum required for statutory assessment:

  • Contact Details: Work email address, full name, organization phone number.
  • Corporate Identity Data: Company name, GSTIN, sector categorization, organization size.
  • Technical Data & Usage Logs: IP address, browser type, device identifiers, session timestamps, and HTTP response headers.
  • Scan Audit Logs: Crawled public endpoint URLs, consent banner signatures, cookie metadata, and policy text snippets.

4. Data Retention Period & Storage Limitation (§8(7))

In accordance with storage limitation principles, personal data is retained only for as long as necessary to satisfy the stated purpose or comply with statutory obligations:

  • Transient Scan Data: Temporary page crawl HTML and cache buffers are automatically purged after 90 days.
  • Customer Account & Audit Records: Active organization profiles and compliance certificates are retained for 2 years during active subscriptions or until account closure.
  • Immediate Deletion: Data is permanently erased or anonymized upon receipt of a verified Data Principal erasure request, unless retention is required by Indian law.

5. Cross-Border Data Transfer & Localization (§16)

All personal and corporate data collected by SYRA DATA is hosted and processed on secure cloud infrastructure located strictly within the territory of India. Zero cross-border data transfers occur to foreign jurisdictions or third-party international cloud vendors without explicit statutory authorization.

6. Data Principal Rights under DPDPA 2023 (§11–§14)

As a Data Principal, you are entitled to exercise the following enforceable rights free of charge:

  • Right to Access (§11): Request a complete summary of personal data processed, identities of sharing entities, and processing purposes.
  • Right to Correction & Erasure (§12): Request correction of inaccurate personal data, completion of incomplete records, or erasure of unnecessary data.
  • Right to Grievance Redressal (§13): Register grievances with our designated Grievance Officer, with guaranteed acknowledgment within 48 hours.
  • Right to Nominate (§14): Nominate an individual who shall exercise your rights in the event of death or incapacity.
  • Right to Withdraw Consent (§6(4)): Withdraw consent at any time through our interactive Consent Management interface.

7. Data Protection Officer (DPO) & Grievance Redressal (§13)

We have appointed a designated Grievance Officer and Data Protection Officer (DPO) to handle all inquiries and statutory rights requests. Grievances are acknowledged within 48 hours and resolved within 30 days as mandated by DPDPA 2023.

Designated Officer: Grievance Redressal Officer / DPO
Email Address: dpdp@bcbuzz.io
Office Address: BCBUZZ Technologies Pvt. Ltd., Bengaluru, Karnataka 560001, India
Response SLA: Initial acknowledgment in 48 hours; final resolution in 30 days

8. Multilingual Availability (§6(3))

This notice is published in English. In accordance with Section 6(3) of the Act, translated versions into any of the 22 languages specified in the Eighth Schedule to the Constitution of India (including Hindi, Bengali, Tamil, Telugu, Kannada, and Marathi) are accessible via our Notice Generator language switcher or upon written request to dpdp@bcbuzz.io.

9. Cookies & Consent Management

We use cookies solely for session security and technical operation. Non-essential cookies are blocked by default until affirmative consent is granted. You may modify or revoke your cookie choices at any time by clicking the "Manage Cookie Preferences" option or clearing your browser storage.